Difficulty Sending Emails - DKIM and SPF Failing

[davidc]

Several of the server's domains are receiving emails, but unable to send them.

Both spf, dkim and dmarc exist in all the domains in question.

gmail is returning a bounce message. (DKIM = did not pass, SPF = did not pass

mail-tester.com is reporting errors with both:

spf: "domain.com does not allow your server 108.160.xx.xx to use [email protected]"

and

dkim: "Your DKIM signature is not valid"

One domain is missing the public and private key

ls -la /etc/virtual/domain.com/dkim.*.key
ls: cannot access '/etc/virtual/domain.com/dkim.*.key': No such file or directory

Anyone have suggestions how to fix this?

David

 

[Richard G]

spf: "domain.com does not allow your server 108.160.xx.xx to use [email protected]"

That seems very clear. Seems your ipv4 is not added in the SPF for that domain. Which is odd, because DA does that automatically normally, unless you use mail on another server than the websites.

One domain is missing the public and private key

Enable DKIM for the domain via the user area. If it's already disabled but key is still missing you can create one via SSH as root like this:

cd /usr/local/directadmin/scripst
./dkim_create.sh domain.com

Ofcourse use the appropriate domain name.

For any further insight, we at least need one domain name with issues and need to know which issue it's having.

 

[MarkAurelius]

Two separate issues show up in that bounce, and they need different fixes.

SPF is the clear one. mail-tester is saying 108.160.x.x is not authorised for the From domain. DirectAdmin only adds the server IP when it builds the SPF itself. If the record was imported or edited by hand, the current outbound IP is often missing. Publish an updated TXT that includes that address (or an include that resolves to it), and stay under the 10-lookup limit or receivers treat the whole SPF as a permerror.

DKIM is the other half. For the domain with no dkim.*.key files, regenerating with dkim_create.sh is right, but the public half still has to exist in DNS at selector._domainkey.domain.com. If DNS lives outside DirectAdmin, the panel cannot push that for you. After you recreate the key, send a test and read the s= value from Authentication-Results, then confirm that selector actually resolves.

One quiet failure mode: some DNS hosts split or truncate long TXT values. A 2048-bit key that looks fine in the panel can still fail validation at Gmail for that reason alone. Worth comparing the published TXT length against what the server is signing with before chasing Exim further.